Vulnerabilities

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow…

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. To remediate this issue, users should upgrade aws-privateca-issuer to version v1.10.1 or the AWS Private CA Connector for Kubernetes EKS add-on to version v1.10.1-eksbuild.1, and update any certificate requests, Certificate resources, or Ingress annotations whose issuerRef.kind is missing, incorrect, or does not match the referenced issuer, since v1.10.1 require

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

AWS

Product

aws-privateca-issuer

CVSS v3.1

8.5 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Weakness

CWE-863

Exposure class

Developer platform, Cloud platform

NVD status

Received

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-119115 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 31
   AWS bulletin AWS 2d ago

   CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

   CVE-2026-119115 Amazon Web Services Kubernetes